Can't remove malware & browser hijacked

koinonia · June 17, 2011

Hello,

I purchased and installed the malwarebyte subscription, but the same malware keeps appearing every time I run a scan. My internet is also hijacked. I would run searches and the link would take me to another website. Thanks in advance for your help.

Below is the Malware log file.

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6866

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/16/2011 7:45:52 PM

mbam-log-2011-06-16 (19-45-52).txt

Scan type: Full scan (C:\|D:\|E:\|)

Objects scanned: 274387

Time elapsed: 50 minute(s), 54 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\localservice\application data\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\documents and settings\localservice\application data\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

DDS File:

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Lily Phan at 19:59:05 on 2011-06-16

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.282 [GMT -7:00]

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\synceng32.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\WINDOWS\system32\TDispVol.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ltmoh\Ltmoh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\system32\dla\DLACTRLW.exe

C:\WINDOWS\system32\hotplug32.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\DOCUME~1\LILYPH~1\LOCALS~1\Temp\AutoDetect.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\system32\SonyIEx.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\WINDOWS\system32\msiexec.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: ST: {9394ede7-c8b5-483e-8773-474bf36af6e4} - c:\program files\msn apps\st\01.03.0000.1005\en-xu\stmain.dll

BHO: 705e2fc6: {9caa4ca7-6bd5-1f9c-83ff-404cef23de9e} - c:\windows\system32\kbdru132.dll

BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar2.dll

BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar2.dll

TB: {0BF43445-2F28-4351-9252-17FE6E806AA0} - No File

TB: MSN: {bdad1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File

TB: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe

uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Ceedo AutoDetect] c:\docume~1\lilyph~1\locals~1\temp\AutoDetect.exe /active

uRunOnce: [Ceedo Repair] c:\docume~1\lilyph~1\locals~1\temp\AutoDetect.exe /repair /drive=

mRun: [TFncKy] TFncKy.exe

mRun: [TDispVol] TDispVol.exe

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [THotkey] c:\program files\toshiba\toshiba applet\thotkey.exe

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [NDSTray.exe] NDSTray.exe

mRun: [Tvs] c:\program files\toshiba\tvs\TvsTray.exe

mRun: [TPSMain] TPSMain.exe

mRun: [smoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe

mRun: [dla] c:\windows\system32\dla\DLACTRLW.exe

mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run

mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [ink Monitor] c:\program files\epson\ink monitor\InkMonitor.exe

mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [TkBellExe] "realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\metama~1.lnk - c:\program files\metamail inc\metamail tray\Metamail Trust Manager.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ramasst.lnk - c:\windows\system32\RAMASST.exe

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A}

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15107/CTPID.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C018A622-B2C2-4B03-8CC9-98918AFDE84E} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443} : NameServer = 203.162.0.181,203.162.4.190

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\windows\system32\kbdru132.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbar-ff3.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\{e6103d7b-6052-4575-a010-59037765e87a}\components\RadioWMPCoreGecko19.dll

FF - component: c:\documents and settings\lily phan\application data\mozilla\firefox\profiles\iyb8mqbn.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true

============= SERVICES / DRIVERS ===============

.

R2 COMSysApp32;COM+ System Application ;c:\windows\system32\synceng32.exe [2011-6-9 785920]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-6-14 366640]

R2 McAfee HackerWatch Service;McAfee HackerWatch Service;c:\program files\common files\mcafee\hackerwatch\HWAPI.exe [2006-8-17 540776]

R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2006-8-17 353368]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [2007-8-4 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-6-14 22712]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S2 McRedirector;McAfee Redirector Service;c:\progra~1\common~1\mcafee\redirsvc\redirsvc.exe [2006-8-17 256096]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\seagate\sync\seasyncservices.exe" --> c:\program files\seagate\sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-3-15 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-3-8 133104]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-6-14 39984]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-06-17 02:46:18 359424 ----a-w- c:\windows\system32\atmpvcno32.dll

2011-06-15 03:59:10 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59:06 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-14 04:54:22 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06:47 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18:07 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Spoon

2011-06-11 05:39:01 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39:01 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy

2011-06-11 05:16:03 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39:54 0 ---ha-w- c:\documents and settings\lily phan\cpafbzsvhc.tmp

2011-06-10 04:45:05 785920 ----a-w- c:\windows\system32\hotplug32.exe

2011-06-10 04:45:05 168960 ----a-w- c:\windows\system32\kbdru132.dll

2011-06-10 04:45:03 785920 ----a-w- c:\windows\system32\synceng32.exe

2011-05-27 23:09:25 -------- d-----w- c:\documents and settings\lily phan\application data\Cheekie_Moonkie

2011-05-27 22:44:52 -------- d-----w- c:\program files\DDTool

2011-05-27 03:31:14 -------- d-----w- C:\THM

2011-05-27 03:28:40 -------- d-----w- c:\windows\XSxS

2011-05-27 03:28:40 -------- d-----w- c:\program files\Xenocode

2011-05-27 03:28:40 -------- d-----w- c:\program files\Winnydows

2011-05-27 03:28:40 -------- d-----w- c:\documents and settings\lily phan\local settings\application data\Xenocode

.

==================== Find3M ====================

.

2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49:32 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-22 03:38:18 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-03-22 03:38:18 249856 -c----w- c:\windows\Setup1.exe

2011-02-26 21:08:30 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00:56 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39:10 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00:52 1622912 -c--a-w- c:\program files\CuteWriter.exe

2006-05-03 19:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll

.

============= FINISH: 20:00:07.75 ===============

screen317 · June 19, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

koinonia · June 19, 2011

Thanks for getting back to me. As requested below are Malwarebyte quick scanlog, Combofix and DDS log.

Malwarebyte quick scan log:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6897

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

6/19/2011 2:58:43 PM

mbam-log-2011-06-19 (14-58-43).txt

Scan type: Quick scan

Objects scanned: 169029

Time elapsed: 8 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\02000000850cdedb1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\02000000850cdedb1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

Combofix Log:

ComboFix 11-06-17.04 - Lily Phan 06/19/2011 15:11:51.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.570 [GMT -7:00]

Running from: c:\documents and settings\Lily Phan\My Documents\Downloads\ComboFix.exe

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\WINDOWS

c:\documents and settings\All Users\Application Data\Tarma Installer

c:\documents and settings\Default User\WINDOWS

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{42208f96-503b-46cf-8c45-7f9701c87863}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{69a62691-03d4-4ca0-a19a-5b5db16bf3a3}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{a6b1bd26-6285-4bd6-8b56-e9ba66b79908}\install.rdf

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\chrome.manifest

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\chrome\xulcache.jar

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\defaults\preferences\xulcache.js

c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\extensions\{bdfd2fb7-419b-49d4-9fff-968810e14f81}\install.rdf

c:\documents and settings\Lily Phan\Application Data\PriceGong

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\1.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\a.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\b.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\c.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\d.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\e.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\f.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\g.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\h.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\i.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\J.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\k.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\l.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\m.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\mru.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\n.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\o.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\p.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\q.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\r.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\s.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\t.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\u.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\v.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\w.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\x.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\y.xml

c:\documents and settings\Lily Phan\Application Data\PriceGong\Data\z.xml

c:\documents and settings\Lily Phan\Templates\deow1vg58852bdtc3g62w37712kpxb620d03722ipd

c:\documents and settings\Lily Phan\WINDOWS

c:\webupdater\WebUpdater.exe

c:\windows\system32\config\systemprofile\WINDOWS

c:\windows\system32\drivers\cgxvpf.sys

c:\windows\system32\Thumbs.db

c:\windows\XSxS

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_ncua

.

((((((((((((((((((((((((( Files Created from 2011-05-19 to 2011-06-19 )))))))))))))))))))))))))))))))

.

2011-06-19 02:11 . 2011-05-10 11:59 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-06-19 02:11 . 2011-05-10 12:03 307928 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-06-19 02:11 . 2011-05-10 12:04 102232 ----a-w- c:\windows\system32\drivers\aswFW.sys

2011-06-19 02:11 . 2011-05-10 12:03 192984 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2011-06-19 02:11 . 2011-05-10 11:59 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-06-19 02:11 . 2011-05-10 12:03 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-06-19 02:11 . 2011-05-10 12:02 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-06-19 02:11 . 2011-05-10 12:02 102616 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-06-19 02:11 . 2011-05-10 12:02 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-06-19 02:11 . 2011-05-10 11:59 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-06-19 02:10 . 2011-05-10 11:40 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2011-06-19 02:10 . 2011-05-10 12:10 40112 ----a-w- c:\windows\avastSS.scr

2011-06-19 02:10 . 2011-05-10 12:10 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\program files\AVAST Software

2011-06-19 02:10 . 2011-06-19 02:10 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2011-06-15 03:59 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-15 03:59 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2011-06-15 02:38 . 2011-06-15 02:38 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2011-06-14 04:54 . 2011-06-14 04:54 -------- d--h--w- c:\windows\system32\GroupPolicy

2011-06-14 04:06 . 2011-05-25 02:14 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-12 04:18 . 2011-06-12 04:18 -------- d-----w- c:\documents and settings\Lily Phan\Local Settings\Application Data\Spoon

2011-06-11 05:39 . 2011-06-14 04:08 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-06-11 05:39 . 2011-06-14 04:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2011-06-11 05:16 . 2011-06-11 14:47 -------- d-----w- c:\program files\DVD Shrink

2011-06-11 03:39 . 2011-06-11 03:39 0 ---ha-w- c:\documents and settings\Lily Phan\cpafbzsvhc.tmp

2011-06-10 04:45 . 2011-06-10 04:45 168960 ----a-w- c:\windows\system32\kbdru132.dll

2011-06-10 04:45 . 2011-06-10 04:44 785920 ----a-w- c:\windows\system32\hotplug32.exe

2011-06-10 04:45 . 2011-06-10 04:44 785920 ----a-w- c:\windows\system32\synceng32.exe

2011-05-28 01:28 . 2011-06-11 18:32 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink

2011-05-27 23:21 . 2011-05-28 02:53 -------- d-----w- c:\program files\Gabest

2011-05-27 23:09 . 2011-05-27 23:09 -------- d-----w- c:\documents and settings\Lily Phan\Application Data\Cheekie_Moonkie

2011-05-27 22:44 . 2011-05-27 23:16 -------- d-----w- c:\program files\DDTool

2011-05-27 03:31 . 2011-06-12 04:24 -------- d-----w- C:\THM

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\program files\Xenocode

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\program files\Winnydows

2011-05-27 03:28 . 2011-05-27 03:28 -------- d-----w- c:\documents and settings\Lily Phan\Local Settings\Application Data\Xenocode

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\system32\GPhotos.scr

2011-04-10 23:49 . 2011-04-10 23:49 0 ----a-w- c:\windows\system32\ConduitEngine.tmp

2011-03-22 03:38 . 2011-03-22 03:38 249856 -c----w- c:\windows\Setup1.exe

2011-03-22 03:38 . 2011-03-22 03:38 73216 ----a-w- c:\windows\ST6UNST.EXE

2011-02-26 21:08 . 2011-01-20 04:01 39564 -c--a-w- c:\program files\RMPly00.exe

2009-03-14 01:00 . 2009-03-14 01:00 6789864 -c--a-w- c:\program files\AmazonUnboxVideo.exe

2009-02-26 22:39 . 2009-02-26 22:30 692379 -c--a-w- c:\program files\setupvni.exe

2007-04-25 16:00 . 2007-04-25 16:00 1622912 -c--a-w- c:\program files\CuteWriter.exe

2011-04-14 16:26 . 2011-04-30 06:07 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2006-05-03 19:06 163328 --sh--r- c:\windows\system32\flvDX.dll

2007-02-21 20:47 31232 --sh--r- c:\windows\system32\msfDX.dll

2008-03-16 22:30 216064 --sh--r- c:\windows\system32\nbDX.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 23:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

2011-01-17 23:54 175912 ----a-w- c:\program files\Swag_Bucks\prxtbSwag.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CAA4CA7-6BD5-1F9C-83FF-404CEF23DE9E}]

2011-06-10 04:45 168960 ----a-w- c:\windows\system32\kbdru132.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{8BDEA9D6-6F62-45EB-8EE9-8A81AF0D2F94}"= "c:\program files\Swag_Bucks\prxtbSwag.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94}]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-05-10 12:10 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="realsched.exe -osboot" [X]

"TFncKy"="TFncKy.exe" [bU]

"TDispVol"="TDispVol.exe" [2005-03-11 73728]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 82009]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2004-08-18 184320]

"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 88203]

"NDSTray.exe"="NDSTray.exe" [bU]

"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 73728]

"TPSMain"="TPSMain.exe" [2005-06-01 282624]

"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-27 122880]

"dla"="c:\windows\system32\dla\DLACTRLW.exe" [2005-10-06 122940]

"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

"Ink Monitor"="c:\program files\EPSON\Ink Monitor\InkMonitor.exe" [2002-08-04 258116]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-05-10 3459712]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-7-4 113664]

Metamail Trust Manager.lnk - c:\program files\Metamail Inc\Metamail Tray\Metamail Trust Manager.exe [2006-6-5 329472]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-2-15 155648]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\kbdru132.dll

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\TOSHIBA\\ConfigFree\\CFXFER.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\synceng32.exe"=

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [6/18/2011 7:10 PM 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [6/18/2011 7:11 PM 192984]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [6/18/2011 7:11 PM 102232]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [6/18/2011 7:11 PM 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/18/2011 7:11 PM 307928]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/18/2011 7:11 PM 19544]

R2 COMSysApp32;COM+ System Application ;c:\windows\system32\synceng32.exe [6/9/2011 9:45 PM 785920]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/14/2011 8:59 PM 366640]

R2 SonyIEx;SonyIEx;c:\windows\system32\SonyIEx.exe [8/4/2007 7:59 PM 126976]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/14/2011 8:59 PM 22712]

S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [6/18/2011 7:10 PM 121000]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S2 gupdate1cabf40d51955e0;Google Update Service (gupdate1cabf40d51955e0);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S2 Seagate Sync Service;Seagate Sync Service;"c:\program files\Seagate\Sync\SeaSyncServices.exe" --> c:\program files\Seagate\Sync\SeaSyncServices.exe [?]

S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [3/15/2011 10:27 PM 183560]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/8/2010 9:27 PM 133104]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/14/2011 8:59 PM 39984]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WUAUSERV

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-09 04:27]

.

2011-06-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

2011-06-19 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1453406303-2187456597-1651317251-1005.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 06:09]

.

------- Supplementary Scan -------

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

IE: &Google Search - c:\program files\google\GoogleToolbar2.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Backward Links - c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar2.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar2.dll/cmtrans.html

Trusted Zone: amazon.com

Trusted Zone: google.com\www

Trusted Zone: phantasticphotography.com\www

Trusted Zone: yahoo.com\www

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C7CAB0AA-82E2-4993-93EA-A69D3797F443}: NameServer = 203.162.0.181,203.162.4.190

FF - ProfilePath - c:\documents and settings\Lily Phan\Application Data\Mozilla\Firefox\Profiles\iyb8mqbn.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - user.js: yahoo.homepage.dontask - true

.

- - - - ORPHANS REMOVED - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-19 15:25

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(5056)

c:\windows\system32\WININET.dll

c:\windows\system32\TDispVol.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\TPwrCfg.DLL

c:\windows\system32\TPwrReg.dll

c:\windows\system32\TPSTrace.DLL

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\AVAST Software\Avast\AvastSvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe

c:\windows\system32\TDispVol.exe

c:\windows\system32\DVDRAMSV.exe

c:\windows\system32\hotplug32.exe

c:\windows\eHome\ehRecvr.exe

c:\windows\AGRSMMSG.exe

c:\program files\TOSHIBA\ConfigFree\NDSTray.exe

c:\windows\eHome\ehSched.exe

c:\program files\Common Files\EPSON\EBAPI\SAgent2.exe

c:\program files\Synaptics\SynTP\Toshiba.exe

c:\windows\system32\TPSBattM.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Microsoft\BingBar\SeaPort.EXE

c:\toshiba\IVP\swupdate\swupdtmr.exe

c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe

c:\windows\ehome\mcrdsvc.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\eHome\ehmsas.exe

c:\windows\system32\dllhost.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\windows\system32\wscntfy.exe

c:\program files\Common Files\Java\Java Update\jucheck.exe

.

**************************************************************************

.

Completion time: 2011-06-19 15:32:40 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-19 22:32

.

Pre-Run: 91,039,035,392 bytes free

Post-Run: 91,000,008,704 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /fastdetect /NoExecute=OptOut

.

- - End Of File - - EA62311CE4F90939A6A685C9D85BAE12

DDS Log:

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21

Run by Lily Phan at 15:38:13 on 2011-06-19

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.247 [GMT -7:00]

.

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

svchost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\synceng32.exe

C:\WINDOWS\system32\TDispVol.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hotplug32.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ltmoh\Ltmoh.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\Toshiba\Tvs\TvsTray.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\WINDOWS\system32\dla\DLACTRLW.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\Program Files\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\Microsoft\BingBar\SeaPort.EXE

C:\WINDOWS\system32\SonyIEx.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\dllhost.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = https://qbo.intuit.com/qbo28/login?redirect=true

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uURLSearchHooks: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Swag Bucks Toolbar: {8bdea9d6-6f62-45eb-8ee9-8a81af0d2f94} - c:\program files\swag_bucks\prxtbSwag.dll

BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll